Greg Kroah-Hartman
Linux kernel maintainer; runs the stable kernel releases and maintains the USB and driver core subsystems.
Greg Kroah-Hartman did not write this page. ppll compiled it from their own words, each linked to the source. Is this you? · Report a mistake
Latest GitHub
What they believe
-
Filesystem corruption or data loss bug fixes should be considered CVE fixes.
Personally, I think that filesystem corruption or data loss bug fixes should be considered a CVE fix, but until cve.org changes their policy, we can not assign CVEs for those types of fixes.
kroah.comSaid 16 Feb 2026This on korrents
-
The current arrangement of the kernel security team may become the standard for project security teams due to the European Union's CRA law.
This arrangement has allowed the kernel security team to remain independent and continue to operate across the different governments that the members operate in, and it looks to become the normal way project security teams work with the advent of the European Union's new CRA law coming into affect which places requirements on response time of companies that receive notice of potential security issues in their projects.
kroah.comSaid 2 Jan 2026This on korrents
The bold line is korrents’ wording; the quote is theirs. These 2: what they wrote before what they said aloud, one per source, newest first.
Feed
As its own page →Hiding
3 November
2 November
1 November
15 October
16 February
From one piece Linux CVE assignment process 3 beliefs · kroah.com
-
korrents.com
NIST/NVD's assignment of CVSS scores to vulnerabilities provides a false sense of security.Their words
ALWAYS ignore any attempt that groups such as NIST/NVD that purport to assign things like CVSS scores to a vulnerability. Those numbers are false and give companies a "fake sense of security".
-
korrents.com
Any group attempting to assign severity scores to a Linux CVE without knowing the specific use case is lying.Their words
So any group that attempts to give a "severity score" to a Linux CVE is lying to you, UNLESS they know exactly your use case.
-
Their words
Personally, I think that filesystem corruption or data loss bug fixes should be considered a CVE fix, but until cve.org changes their policy, we can not assign CVEs for those types of fixes.
2 January
From one piece Linux kernel security work 2 beliefs · kroah.com
-
Their words
As history has shown us with Spectre and Meltdown, this "no embargo" policy does not always work well when working with problems that cross operating systems and hardware platforms, possibly requiring firmware or microcode updates.
-
Their words
This arrangement has allowed the kernel security team to remain independent and continue to operate across the different governments that the members operate in, and it looks to become the normal way project security teams work with the advent of the European Union's new CRA law coming into affect which places requirements on response time of companies that receive notice of potential security issues in their projects.
9 December 2025
From one piece Linux kernel version numbers 3 beliefs · kroah.com
-
korrents.com
It is not safe to compare kernel branches against each other using simple version number comparisons to track fixes.Their words
It is NOT safe to do a simple "if this version number is bigger than the previous one, then all fixes for it will be in the next release." You have to treat each kernel "branch" as a unique tree, and not compare them against each other in order to be able to properly track changes over time.
-
Their words
No kernel release should ever break any existing user's code or workflow.
-
korrents.com
All Linux kernel releases are stable and backwards compatible for userspace programs to all previous kernel releases.Their words
All releases are "stable" and backwards compatible for userspace programs to all previous kernel releases.
8 December 2025
-
korrents.com
The CVE JSON format is much more complicated than the format used by the kernel community to track CVE assignments.Their words
document a way that people can track CVE assignments on their own in a format that is, in my opinion, much simpler than attempting to rely on the CVE json format (and don't get me started on NVD...)
4 November 2025
17 August 2025
Nothing matches.
Beliefs
Korrents What they believe 13 beliefs — each backed by an exact quote.
Each is a — compiled by korrents.com, not by them: the one-line wordings are korrents', the quotes are theirs.
Recent
Filesystem corruption or data loss bug fixes should be considered CVE fixes.
Personally, I think that filesystem corruption or data loss bug fixes should be considered a CVE fix, but until cve.org changes their policy, we can not assign CVEs for those types of fixes.
Linux CVE assignment process Said 16 Feb 2026
Any group attempting to assign severity scores to a Linux CVE without knowing the specific use case is lying.
So any group that attempts to give a "severity score" to a Linux CVE is lying to you, UNLESS they know exactly your use case.
Linux CVE assignment process Said 16 Feb 2026
NIST/NVD's assignment of CVSS scores to vulnerabilities provides a false sense of security.
ALWAYS ignore any attempt that groups such as NIST/NVD that purport to assign things like CVSS scores to a vulnerability. Those numbers are false and give companies a "fake sense of security".
Linux CVE assignment process Said 16 Feb 2026
Show 10 more
The current arrangement of the kernel security team may become the standard for project security teams due to the European Union's CRA law.
This arrangement has allowed the kernel security team to remain independent and continue to operate across the different governments that the members operate in, and it looks to become the normal way project security teams work with the advent of the European Union's new CRA law coming into affect which places requirements on response time of companies that receive notice of potential security issues in their projects.
Linux kernel security work Said 2 Jan 2026
The 'no embargo' policy for kernel security is difficult to maintain when dealing with hardware and operating system cross-platform issues.
As history has shown us with Spectre and Meltdown, this "no embargo" policy does not always work well when working with problems that cross operating systems and hardware platforms, possibly requiring firmware or microcode updates.
Linux kernel security work Said 2 Jan 2026
All Linux kernel releases are stable and backwards compatible for userspace programs to all previous kernel releases.
All releases are "stable" and backwards compatible for userspace programs to all previous kernel releases.
Linux kernel version numbers Said 9 Dec 2025
No kernel release should ever break an existing user's code or workflow.
No kernel release should ever break any existing user's code or workflow.
Linux kernel version numbers Said 9 Dec 2025
It is not safe to compare kernel branches against each other using simple version number comparisons to track fixes.
It is NOT safe to do a simple "if this version number is bigger than the previous one, then all fixes for it will be in the next release." You have to treat each kernel "branch" as a unique tree, and not compare them against each other in order to be able to properly track changes over time.
Linux kernel version numbers Said 9 Dec 2025
The CVE JSON format is much more complicated than the format used by the kernel community to track CVE assignments.
document a way that people can track CVE assignments on their own in a format that is, in my opinion, much simpler than attempting to rely on the CVE json format (and don't get me started on NVD...)
Linux CVEs, more than you ever wanted to know Said 8 Dec 2025
Supporting a kernel for 6 years requires constant testing by users of the kernels.
The above is what I need in order to be able to support a kernel for 6 years, constant testing by users of the kernels.
Helping Out With Lts Kernel Releases Said 3 Feb 2021
The best solution for most Linux users is to use the kernel provided by their favorite Linux distribution.
The best solution for almost all Linux users is to just use the kernel from your favorite Linux distribution.
What Stable Kernel Should I Use Said 24 Aug 2018
Using older LTS releases in general computing environments with untrusted users or virtual machines is not recommended.
These kernels are not to be used in any type of "general computing" model where you have untrusted users or virtual machines, as the ability to do some of the recent Spectre-type fixes for older releases is greatly reduced, if present at all in some branches.
What Stable Kernel Should I Use Said 24 Aug 2018
The community cannot support companies that use unmaintained kernel releases.
The community can not support you as no one is watching all kernel versions for specific issues, so you will have to rely on in-house support for everything that could go wrong.
What Stable Kernel Should I Use Said 24 Aug 2018
What is a korrent?
A korrent is a belief a person has stated in their own words: one sentence stating the claim, backed by a quote and a source, kept at korrents.com.
Under a name here, the quoted block is what they actually said. The korrent beneath it is the claim those words support, in korrents' wording — tap it to see the record, its source, and who else holds it.
Nobody here wrote their own korrents. They are compiled from public statements, and a person can change their mind, which is recorded too.
Recommends rcmnd
rcmnd What they recommend 13 things — each backed by an exact quote.
Compiled by rcmnd.app, not by them: the quotes are theirs, and each links to the post it was copied from.
Recent
Liked Nexus 7
I also have a Nexus 7 tablet, which I'm finding I like more and more these days, and have given up my previous Kindle and iPad for it.
usesthis.com 15 Nov 2012
Uses AWS
Thanks to Amazon's generosity, I've been doing a lot more kernel build testing on their AWS systems, utilizing a 32 processor, 64Gb virtual machine, allowing me to build multiple kernels at the same time all on a RAM disk in minutes.
usesthis.com 15 Nov 2012
sponsored
Liked CyanogenMod
My Nexus 7 tablet is running the nightly CyanogenMod releases and have had no problems at all with it.
usesthis.com 15 Nov 2012
Show 10 more
Loved git
Combined with git, the best source code control tool I've ever used (and I've used them all), I can set up a bare machine in a matter of minutes and have full access to all of my kernel trees, emails, and development tools.
usesthis.com 15 Nov 2012
Liked i3
I'm finding that i3 is really good for my use cases (lots of terminal windows open, virtual screens, and fast keyboard navigation of everything.)
usesthis.com 15 Nov 2012
Mixed on GNOME 3
For desktop environment, on my workstation, I use GNOME 3, despite me complaining about it all the time.
usesthis.com 15 Nov 2012
Uses quilt
I use quilt on top of git for handling the Linux kernel stable patch set as the workflow there does not lend itself to a pure git environment.
usesthis.com 15 Nov 2012
Uses msmtp
To send email I rely on msmtp to be able to handle queueing of emails when I do not have any connectivity (like on airplanes).
usesthis.com 15 Nov 2012
Uses offlineimap
I use offlineimap for syncing email around on all of the different systems I use.
usesthis.com 15 Nov 2012
Uses mutt
For daily use, I live in mutt and vim for email and editing.
usesthis.com 15 Nov 2012
Uses Gentoo Linux
I run Gentoo Linux on my servers and my build machine.
usesthis.com 15 Nov 2012
Liked Arch Linux
I am trying out Arch Linux on my MacBook as I wanted to see how that distro was due to hearing good things about it. So far I'm impressed with it, and given that openSUSE doesn't work on the MacBook Pro yet, I'm sticking with it for now.
usesthis.com 15 Nov 2012
Uses openSUSE Tumbleweed
On the desktop I am running the openSUSE Tumbleweed distribution (a rolling version of openSUSE that provides the latest stable packages) as I'm the one responsible for that distribution.
usesthis.com 15 Nov 2012
their own
Where they publish
Blog kroah.com His blog on the kernel, stable releases and maintainership.
Link verified 20 Sept 2026.
GitHub @gregkh Kernel trees and tools.
Recent
- kernel-development — Presentation on how the Linux kernel is developed 3 Nov 2026
- usbutils — USB utilities for Linux, including lsusb 3 Nov 2026
- linux — Linux kernel stable tree mirror 2 Nov 2026
Show 4 more
Link verified 20 Sept 2026. Recent items update automatically from the channel.
About the English under a post
Some people here publish in a language other than English. Where they do, this site shows a machine translation beneath the post, in this typeface — the site's own, not theirs.
The post itself is never changed, moved or hidden: what is set in the serif above is exactly what the person published, and it is what to quote them on. A translation can be wrong in ways that matter, especially about tone.
Only the post's own words are translated. A quoted post, a linked article and a belief on korrents.com are left in their original language.